Kimai EUVD-2026-66217

Exploitation requires an authenticated Kimai account holding the teamlead role or equivalent permission to edit the target team, corresponding to PR:L in the CVSS 4.0 vector. The attacker needs network access to the Kimai API (AV:N). No non-default server configuration is required-the flaw exists in all default Kimai installations before 2.63.0. Exploitation scope is limited to teams the attacker's account has edit permissions over; cross-team attacks are not possible without broader privileges. No victim interaction is required, and the damage (empty team state) is persistent rather than transient. Exploitation is bounded by the attacker's team-edit scope and does not enable direct data exfiltration-harm is primarily through disruption of access control structures.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H scores 8.7, reflecting a network-reachable attack requiring only a low-privilege teamlead account and no special conditions. These impact ratings are plausible where team membership gates access to sensitive project records, but may overstate risk in flat, open-access Kimai deployments where team controls are largely cosmetic. No EPSS score is present in the available data, no CISA KEV listing exists, and no POC code has been identified-suggesting this is a freshly disclosed issue without evidence of active abuse. Real-world risk is therefore moderate and context-dependent: organizations relying on team-based access control for data segregation face meaningful disruption risk, while the low-privilege prerequisite limits opportunistic exploitation to insider threat or account-compromise scenarios rather than unauthenticated mass attacks.

An authenticated Kimai teamlead crafts a PATCH /api/teams/{id} request that references non-existent or invalid user IDs in the members array. Kimai immediately deletes all current team member rows, then fails input validation and returns an HTTP error-leaving the team permanently empty, with no members and no teamleaders. The attacker can silently repeat this against every team within their edit scope, dismantling team-based access boundaries without any successful API response to alert defenders.